I'm using twofish. Say you have a 120 bit key, is there any difference in using a 128 bit bit keylength or a 256 bit one?
Since the most significant digits of the key will be allo zero in both cases, does the keylen parameter really matter?
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
Well, it turns out that, both from a security and a performance standpoint, it doesn't really matter.
From a security standpoint, the goal (which, as far as we know, Twofish achieves) is that if you know all but N bits of the key, it still takes about $2^N$ trial decrypts to recover the remaining bits. So, it doesn't matter if you have a 128 bit Twofish key (and give the attacker 8), or if you have a 256 bit Twofish key (and give the attacker 136); he still needs to iterate through the remaining 120 bits.
From a performance standpoint, the only difference between 128 bit Twofish keys and 256 bit Twofish keys is during the key scheduling operation; after that, the encryption and decryption operations do not depend on the key size.
On the other hand, if you go through the Twofish specification, we find that they do specify how to use odd-sized keys; you append zero bytes up to the next "standard" size (which would be 128 bits in this case); this is section 4.3.1 of the book.
Given that there is a standard way to handle it, well, you might as well go with it.
